File name:

582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.zip

Full analysis: https://app.any.run/tasks/5ef43231-b927-4682-b06f-f68710e4ba05
Verdict: Malicious activity
Analysis date: May 15, 2025, 23:43:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
adobeinstaller
installer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=AES Encrypted
MD5:

47F01A8CD3141561BCC1B725365DE003

SHA1:

00A6453D8B1FE9B5EC315F00D217EC2EFEBE4B7D

SHA256:

C8EA0B8A3F397724C70705E7EF5A8BB772960674DCF6C3705D088F4BD1B78C6C

SSDEEP:

98304:aMJVAQQKrN7NIsciUBT0efOAOENMWwmumKAiolmRRmqqBGe6HMKze0GVbvLCkt8C:trdXkuO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe (PID: 3240)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7356)
      • 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe (PID: 3240)

  • INFO

    • Reads the software policy settings

      • slui.exe (PID: 7512)
      • slui.exe (PID: 6436)
      • 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe (PID: 3240)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7356)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7356)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 6476)

    • Create files in a temporary directory

      • 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe (PID: 3240)

    • Manual execution by a user

      • 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe (PID: 3240)

    • Checks supported languages

      • 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe (PID: 3240)

    • Checks proxy server information

      • slui.exe (PID: 6436)
      • 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe (PID: 3240)

    • ADOBEINSTALLER mutex has been found

      • 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe (PID: 3240)

    • Reads the machine GUID from the registry

      • 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe (PID: 3240)

    • Reads the computer name

      • 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe (PID: 3240)

    • Creates files or folders in the user directory

      • 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe (PID: 3240)

    • Process checks whether UAC notifications are on

      • 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe (PID: 3240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:15 23:37:24
ZipCRC: 0xb5eb3d5e
ZipCompressedSize: 2144011
ZipUncompressedSize: 5294128
ZipFileName: 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
7
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe slui.exe rundll32.exe no specs openwith.exe no specs 582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe

Process information

PID
CMD
Path
Indicators
Parent process
1676C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3240"C:\Users\admin\Desktop\set-up.exe\582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe" C:\Users\admin\Desktop\set-up.exe\582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe
explorer.exe
User:
admin
Company:
Adobe Inc.
Integrity Level:
MEDIUM
Description:
Adobe Installer
Exit code:
1
Version:
5.0.0.354
Modules
Images
c:\users\admin\desktop\set-up.exe\582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\setupapi.dll
6436C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6476C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7356"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7480C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7512"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
8 500
Read events
8 464
Write events
23
Delete events
13

Modification events

(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.zip
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
Executable files
1
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3240582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44Dbinary
MD5:F47D984AF6AB0EB8EE631E589528E3E7
SHA256:42F571CBAED30385523D05D1F7B0B61ACF961729DE4F79B0FF69C53B75AA7180
3240582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44Dbinary
MD5:312005DE7821BF1EB475537C5A265719
SHA256:114849422CBB750E2619CDDF380AD202E1597D13D9E2CD088D1312914FB03916
3240582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929binary
MD5:F4A01356AEEDCA21361B7338944152FF
SHA256:04F380F2C0B8DF4BACC343FEBDEEE9C6E4E9D065395A25E87E133C224E5A03A6
3240582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exeC:\Users\admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.logtext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
3240582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929binary
MD5:EC21F90FEDF3BFFBABFA9A8B9192E5F9
SHA256:407BA2066C879976AC070EF443AC2F13AD6487F4F374AF33B4C4C5AAAC1A31F0
7356WinRAR.exeC:\Users\admin\Desktop\set-up.exe\582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.binexecutable
MD5:9CFA0D88F0B614D1FF6FC69B703A839A
SHA256:582536081E67975055CCF8DE5353502D7BDA56F2AAFCBEFBB400F3D9012019C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
22
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3240
582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D
unknown
—
—
whitelisted
8024
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3240
582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAbyTZ9NsHvX7K0Gf17ibCk%3D
unknown
—
—
whitelisted
8024
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
8024
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
  • 23.216.77.20
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.3
  • 20.190.159.4
  • 20.190.159.128
  • 20.190.159.64
  • 40.126.31.0
  • 20.190.159.23
  • 20.190.159.75
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
582536081e67975055ccf8de5353502d7bda56f2aafcbefbb400f3d9012019c9.zip